0ed5082671e2e76364270ab05d71de8286a2b8ca8fe97f0abdfb394a480c50a2

Analysis

max time kernel
120s
max time network
17s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14-08-2024 05:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1f2516fd1e25be65e4bf14d145cd70c0N.exe
Size

83KB
MD5

1f2516fd1e25be65e4bf14d145cd70c0
SHA1

9aa9c6ca08ae143227106f06035e9309a3d0c56d
SHA256

0ed5082671e2e76364270ab05d71de8286a2b8ca8fe97f0abdfb394a480c50a2
SHA512

56d07cc3c426f10a68c48c21bd01d82b7dfc84c4208f3f889114d5ec9d5e495eed189af8f010df38f769d0ba808f870fe91682fb5fa6f9604be279bff1c54bee
SSDEEP

1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhw:6pWpUFpEhLfyBtPf50FWkFpPDze/qFs5

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3191) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\South_Georgia.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Rangoon.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\Common Files\System\ado\msado26.tlb.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Aqtau.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\vlm.xml.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaSansDemiBold.ttf.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\US_export_policy.jar.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\Java\jre7\lib\sound.properties.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\Microsoft Games\Chess\de-DE\Chess.exe.mui.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG_PAL.wmv.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Auckland.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.engine_2.3.0.v20140506-1720.jar.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.nl_ja_4.4.0.v20140623020002.jar.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-api-caching.jar.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Helsinki.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861261279.profile.gz.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-visual.xml.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Abstractions.dll.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576_91n92.png.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\epl-v10.html.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench.nl_zh_4.4.0.v20140623020002.jar.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-execution.jar.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-visual_zh_CN.jar.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ca@valencia\LC_MESSAGES\vlc.mo.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_SelectionSubpicture.png.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2iexp.dll.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cayman.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.net.nl_zh_4.4.0.v20140623020002.jar.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Miquelon.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\St_Johns.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Simferopol.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\HST10.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Dot.png.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\default.jfc.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.ja_5.5.0.165303.jar.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Dili.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\WindowsFormsIntegration.resources.dll.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Yellowknife.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Mazatlan.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\feature.xml.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.ja_5.5.0.165303.jar.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core_2.3.0.v20131211-1531.jar.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-templates_zh_CN.jar.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IPSEventLogMsg.dll.mui.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jayapura.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Canary.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Dawson_Creek.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring-fallback.jar.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libcvdsub_plugin.dll.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\GMT.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\shvlzm.exe.mui.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Management.Instrumentation.Resources.dll.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-image-mask.png.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\license.html.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes.nl_zh_4.4.0.v20140623020002.jar.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_de.properties.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\Microsoft Games\Solitaire\ja-JP\Solitaire.exe.mui.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcfr.dll.mui.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme_0.9.300.v20140424-2042.jar.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\Java\jre7\bin\jsound.dll.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\Java\jre7\lib\security\javafx.policy.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe.tmp	1f2516fd1e25be65e4bf14d145cd70c0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1f2516fd1e25be65e4bf14d145cd70c0N.exe

C:\Users\Admin\AppData\Local\Temp\1f2516fd1e25be65e4bf14d145cd70c0N.exe
"C:\Users\Admin\AppData\Local\Temp\1f2516fd1e25be65e4bf14d145cd70c0N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1385883288-3042840365-2734249351-1000\desktop.ini.tmp

Filesize
84KB

MD5
f022052fc26503ea7a4073b571a4d3aa

SHA1
a9dd10bdb29f4c53213af32a4f184c00826337b9

SHA256
f4a4e6d4028c16e0968e432afc620e1a764ea381388f50b9137b8c6bab265fac

SHA512
88280cf1100b63c54e198d368f28f910970f980c6b26e5e95beac1b0c2a1045d3c9d028da1c19adc46d66c6aa02ab999d4c193716c9403e3798d4d84e525536c

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
93KB

MD5
2ebbf49cacb1e792b9bb8d26fdb032f6

SHA1
33099dd21152dd791681a4b80758af0a024d18c9

SHA256
6c8d74cdac95131fe92cb4fda9a481514f89cb897d38f8891f9a97d56d2a3a76

SHA512
19215c4a84eda0175b22c5d333e346ea8e47054a9d2938c14e4398e70269a4412397201055c4a75a008796a83395b980c3ebd1bb7f5c36a51bf49df8befd52cb

Download Submit